Google PCA Practice Test 48 — 15 Questions

Question 1

A company has a Cloud SQL for PostgreSQL instance that experiences high connection overhead. Developers frequently open and close connections. Which solution reduces connection overhead without code changes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure PgBouncer as a sidecar. Cloud SQL Auth Proxy provides secure connections but does not pool. PgBouncer is a connection pooler for PostgreSQL; it maintains a pool of connections and reuses them. Increasing max_connections doesn't reduce overhead. Using private IP alone doesn't pool.

Answer

Increase max_connections in Cloud SQL

Answer

Switch to Private IP

Answer

Use Cloud SQL Auth Proxy

Question 2

A company runs a web application on Compute Engine behind a HTTP(S) Load Balancer. They want to reduce latency for users worldwide. Which Google Cloud service should they use?

Accepted Answer

Cloud CDN. Cloud CDN caches content at Google's edge locations, reducing latency for global users. Cloud Armor is for security, Cloud NAT for outbound connectivity, and Cloud VPN for site-to-site VPN.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

Cloud VPN

Question 3

A company runs a global application that requires strong consistency across regions for financial transactions. Which database should they choose?

Accepted Answer

Cloud Spanner. Cloud Spanner provides global strong consistency and horizontal scaling. Bigtable offers eventual consistency. Firestore provides strong consistency within a region but not globally. Cloud SQL is regional.

Answer

Cloud SQL

Answer

Cloud Bigtable

Answer

Firestore

Question 4

A company runs batch machine learning training jobs that can be interrupted. They want to reduce compute costs. Which Compute Engine VM pricing model is MOST cost-effective?

Accepted Answer

Preemptible VMs. Preemptible VMs offer up to 60-91% discount and can be terminated at any time, ideal for batch workloads that are fault-tolerant. Sustained use discounts are automatic but less aggressive. Committed use discounts require 1 or 3 year commitment. Standard VMs are full price.

Answer

Standard VMs

Answer

Sustained use discounts

Answer

Committed use discounts

Question 5

A company is migrating a legacy application to Google Cloud. The application has a stateful TCP-based protocol that requires client IP persistence. They plan to use a load balancer. Which load balancer type should they choose?

Accepted Answer

External Network Load Balancer (passthrough). The External Network Load Balancer (passthrough) is the correct choice because it preserves the original client IP address via direct server return (DSR) and does not terminate the TCP connection. This is essential for stateful TCP-based protocols that require client IP persistence, as the backend instances see the actual client IP and can maintain session state.

Answer

External HTTP(S) Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

External TCP Proxy Load Balancer

Question 6

A developer needs to securely store a database password that will be used by a Compute Engine instance. The password must be rotated automatically every 30 days. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed for storing secrets like API keys and passwords, and it supports automatic rotation schedules. Cloud KMS is for encryption keys, not generic secrets. Cloud Storage can store encrypted data but does not natively support rotation. Environment variables are insecure and not managed.

Answer

Cloud KMS

Answer

Cloud Storage with encryption

Answer

Environment variables

Question 7

A company is using Cloud SQL for PostgreSQL and needs to run a one-time heavy analytical query that takes over 30 minutes and uses 100% CPU. The production database is serving user traffic with high QPS. What should the company do to run the query without impacting production?

Accepted Answer

Create a read replica of the production instance and run the query on the replica.. A read replica in Cloud SQL for PostgreSQL is a separate instance that asynchronously replicates data from the primary. Running the heavy analytical query on the replica offloads the CPU-intensive workload from the production primary, ensuring user-facing traffic with high QPS is not impacted. The replica can handle read-only queries without affecting the primary's performance or availability.

Answer

Run the query directly on the primary instance during low traffic hours.

Answer

Use Cloud SQL's pgBouncer to pool connections and queue the query.

Answer

Create a clone of the production instance and run the query on the clone.

Question 8

You are designing a CI/CD pipeline for a containerized application on Google Cloud. The application is built with Cloud Build, stored in Container Registry, and deployed to GKE. The team wants to ensure that only images that pass vulnerability scanning are deployed. What should you do?

Accepted Answer

Add a step in Cloud Build that runs a vulnerability scanner on the image and fails the build if vulnerabilities exceed a threshold.. Cloud Build can include a custom step that runs a vulnerability scanner (e.g., using the Google Cloud `gcloud container images list-tags` with the `--show-occurrences-from` flag or a third-party tool like Trivy) and then evaluates the results against a threshold. If the scan finds vulnerabilities exceeding the defined threshold, the build step exits with a non-zero status, causing the Cloud Build pipeline to fail and preventing the image from being pushed to Container Registry or deployed. This directly enforces the requirement that only images passing vulnerability scanning proceed in the CI/CD pipeline.

Answer

Configure Container Analysis to automatically scan images in Container Registry and block deployment via a webhook.

Answer

Enable Binary Authorization on the GKE cluster and configure a policy to require an attestation from a trusted authority.

Answer

Use Security Command Center to detect vulnerabilities and alert the team to manually block deployments.

Question 9

A company wants to connect their on-premises network to Google Cloud with a 99.99% SLA using encrypted tunnels over the public internet. Which connectivity solution should they choose?

Accepted Answer

HA VPN. HA VPN provides a 99.99% SLA when configured with two VPN gateways and four tunnels over the public internet. Dedicated Interconnect is a private connection with higher bandwidth but not over the public internet. Partner Interconnect uses a partner's network, not the public internet. Standard VPN does not offer a 99.99% SLA.

Answer

Standard VPN with single tunnel

Answer

Partner Interconnect

Answer

Dedicated Interconnect

Question 10

An engineer needs to troubleshoot a production issue on a Compute Engine instance. They suspect the instance is running out of memory. Which THREE actions should they take to diagnose the problem? (Choose THREE.)

Accepted Answer

SSH into the instance and run 'free -m' to check memory usage. Common troubleshooting involves checking instance metrics (Cloud Monitoring), analyzing logs (Cloud Logging), and connecting to the instance to run commands.

Answer

Increase the instance's memory by changing the machine type

Answer

Create a snapshot of the boot disk

Question 11

A startup deploys a web application on Compute Engine instances behind an HTTP load balancer. They need to handle unpredictable spikes in traffic with minimal operational overhead. What is the simplest scaling approach?

Accepted Answer

Use a managed instance group with autoscaling based on CPU utilization. Using a managed instance group with autoscaling automatically adds/removes instances based on demand, requiring minimal manual intervention. Other options either require more complex setup or are not optimal.

Answer

Set up a Kubernetes cluster with horizontal pod autoscaling

Answer

Migrate the application to Cloud Run

Answer

Add more instances manually during peak hours

Question 12

A company is designing a highly available architecture for a web application using Google Cloud. They need to ensure that the application remains available even if an entire Google Cloud region experiences an outage. Which THREE components should they include in their architecture? (Choose THREE.)

Accepted Answer

Cloud Spanner multi-region configuration. For multi-region high availability, use a global load balancer, deploy instances in multiple regions (e.g., via regional MIGs), and use a multi-region database like Cloud Spanner or cross-region replication.

Answer

Cloud SQL with a cross-region read replica

Answer

Cloud CDN

Question 13

Which Google Cloud service provides a fully managed, auto-scaling environment for running stateless HTTP(S) web applications using a variety of supported programming languages?

Accepted Answer

App Engine Standard. App Engine Standard is the correct choice because it is a fully managed, auto-scaling platform specifically designed for stateless HTTP(S) web applications. It supports multiple programming languages (e.g., Python, Java, Go, PHP, Node.js) and automatically handles scaling, load balancing, and patching, allowing developers to focus on code without managing infrastructure.

Answer

Cloud Functions

Answer

Google Kubernetes Engine

Answer

Compute Engine

Question 14

An organization needs to implement a change management process for a mission-critical application on GKE. They want to validate performance before full rollout and be able to roll back quickly. Which THREE practices should they adopt? (Choose THREE.)

Accepted Answer

Implement canary deployments with traffic splitting. Phased rollouts (canary) and gradual traffic shifting allow validation and rollback. Feature flags enable toggling features without redeployment. Automated rollback policies ensure quick recovery. Direct rollout to production is risky. Manual rollback is slow.

Answer

Deploy changes directly to production

Answer

Manually monitor and roll back if issues appear

Question 15

An e-commerce platform runs on GKE with Autopilot. The team wants to perform a canary deployment where 10% of traffic goes to a new version. They need to monitor the canary's error rate and latency, and automatically roll back if thresholds are exceeded. Which TWO services or features should they use together?

Accepted Answer

Cloud Monitoring. Cloud Deploy can orchestrate canary deployments with traffic splitting. Cloud Monitoring provides alerting that can trigger rollbacks. GKE Autopilot does not support node management. Traffic Director is for service mesh traffic management but not directly for canary deployments with automatic rollback. Cloud Scheduler is for cron jobs, not deployment.

Answer

GKE Autopilot node pools

Answer

Cloud Scheduler

Answer

Traffic Director